GitHub proxy: git to prompt for password when tsh session expires

api/utils/prompt/stdin.go

@@ -17,13 +17,17 @@ limitations under the License.
 package prompt
 
 import (
+	"context"
+	"log/slog"
 	"os"
+	"runtime"
 	"sync"
 )
 
 var (
-	stdinMU sync.Mutex
-	stdin   StdinReader
+	stdinMU               sync.Mutex
+	stdin                 StdinReader
+	stdinTerminalFallback bool
 )
 
 // StdinReader contains ContextReader methods applicable to stdin.
@@ -42,6 +46,7 @@ func Stdin() StdinReader {
 	defer stdinMU.Unlock()
 	if stdin == nil {
 		cr := NewContextReader(os.Stdin)
+		cr = maybeUseStdinTerminalFallbackLocked(cr)
 		go cr.handleInterrupt()
 		stdin = cr
 	}
@@ -69,3 +74,33 @@ func NotifyExit() {
 	}
 	stdinMU.Unlock()
 }
+
+// EnableStdinTerminalFallback attempts to use a fallback like /dev/tty when stdin is
+// not the terminal. This can be useful when tsh is called by another tool (e.g.
+// git).
+func EnableStdinTerminalFallback() {
+	stdinMU.Lock()
+	defer stdinMU.Unlock()
+	stdinTerminalFallback = true
+}
+
+func maybeUseStdinTerminalFallbackLocked(org *ContextReader) *ContextReader {
+	if !stdinTerminalFallback || runtime.GOOS == "windows" || org.IsTerminal() {
+		return org
+	}
+
+	devTTY, err := os.Open("/dev/tty")
+	if err != nil {
+		slog.DebugContext(context.Background(), "Failed to open /dev/tty", "error", err)
+		return org
+	}
+
+	cr := NewContextReader(devTTY)
+	if !cr.IsTerminal() {
+		slog.DebugContext(context.Background(), "/dev/tty is not a terminal")
+		return org
+	}
+
+	slog.DebugContext(context.Background(), "Using /dev/tty for prompt")
+	return cr
+}

tool/tsh/common/git_ssh.go

@@ -27,6 +27,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/api/utils/prompt"
 	"github.com/gravitational/teleport/lib/client"
 )
 
@@ -61,9 +62,10 @@ func (c *gitSSHCommand) run(cf *CLIConf) error {
 		return trace.BadParameter("user-host %q is not GitHub", c.userHost)
 	}
 
-	// TODO(greedy52) when git calls tsh, tsh cannot prompt for password (e.g.
-	// user session expired) using provided stdin pipe. `tc.Login` should try
-	// hijacking "/dev/tty" and replace `prompt.Stdin` temporarily.
+	// This command is invoked by "git" so try some fallbacks when stdin is not
+	// the terminal.
+	prompt.EnableStdinTerminalFallback()
+
 	identity, err := getGitHubIdentity(cf, c.gitHubOrg)
 	if err != nil {
 		return trace.Wrap(err)